UNCX Vesting Pool Exploited; Loss Estimates Vary Between Sources

The Exploit Mechanics

The UNCX Vesting V2 exploit centered on a share-accounting flaw that permitted attackers to inflate their claims on tokens held in communal pools. According to Gonçalo Magalhães, head of security at Immunefi, the vulnerability allowed bad actors to misrepresent their ownership stake and withdraw more than their proportional share of pooled assets. One confirmed transaction moved five different tokens out of the affected Ethereum contract.

Conflicting Loss Figures and Scope

Security firm Blockaid pegged the loss at approximately $86,000 tied to the single identified transaction on Ethereum, where the contract retained roughly $3.25 million in assets post-exploit. Immunefi's security chief, however, reported total losses of about $1.5 million drained across four chains, suggesting either additional exploitations beyond the single flagged transaction or a broader attack surface than Blockaid's initial assessment captured. The discrepancy may reflect different methodologies for calculating stolen value or incomplete visibility into all affected pools at the time of reporting.

Ongoing Status

The Ethereum-based vesting contract remained operational with substantial liquidity intact, though the vulnerability's multi-chain presence indicated potential exposure on other networks. UNCX did not immediately announce a comprehensive remediation timeline across all affected chains.